LockBit 3.0 Ransomware Attack on Kioti Tractor
Incident Date:
May 9, 2024
Overview
Title
LockBit 3.0 Ransomware Attack on Kioti Tractor
Victim
Kioti Tractor
Attacker
Lockbit3
Location
First Reported
May 9, 2024
Ransomware Attack on Kioti Tractor by LockBit 3.0
Overview
The cyberattack on KIOTI by the LockBit 3.0 ransomware group in May 2024 targeted the company's website and originated from the USA. The attackers were able to exfiltrate 382 GB of sensitive data, including accounting records, business operations data, financial records, HR information, and personally identifiable information (PII). A sample of this leaked data was made available, increasing the potential damage to Kioti's reputation and security.
Company Profile
Kioti Tractor, also known as Daedong in North America and Europe, is a leading company specializing in high-quality tractors, UTVs, zero-turn mowers, attachments, and implements. The company was established in 1993 and is headquartered in Wendell, North Carolina. Kioti is committed to providing top-notch products and services, with a focus on customer satisfaction and teamwork.
The company offers a wide range of tractor models, utility vehicles, and attachments, catering to various needs from commercial farming to hobby farming and garden maintenance. Kioti has a strong dealer network of over 450 dealers in the U.S., ensuring efficient distribution and service. The company has a rich history of innovation and growth, continuously expanding its product lines and implementing advanced technologies in its machinery.
LockBit 3.0 Ransomware Group
LockBit 3.0, also known as LockBit Black, is a new variant of the LockBit ransomware that emerged in 2022. It is considered one of the most dangerous and disruptive ransomware threats currently active. The ransomware encrypts files, modifies their filenames, changes the desktop wallpaper, and drops a ransom note on the victim's desktop. LockBit 3.0 is heavily obfuscated and protected against analysis, making it challenging for security researchers to study. The ransomware has features like lateral movement through a network via group policy updates and the ability to delete traces of itself to cover its tracks.
LockBit May Attacks
This is part of the May 2024 attacks by LockBit 3.0, a cybercriminal group that resurfaced following the disruption of its infrastructure in February during "Operation Cronos." Despite law enforcement efforts, LockBit swiftly returned, targeting over 50 victims within hours of reactivating its platform. The group's recent activities targeted diverse industries globally, with manufacturing companies, professional services, and the ICT sector being the most affected. LockBit's resurgence highlights the need for enhanced international cooperation and proactive measures to combat cybercrime effectively.
Sources:
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.